CVE-2006-6466

Multiple cross-site scripting XSS vulnerabilities in WBmap.php in WikyBlog 1.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 key, 2 d, 3 l, or 4 v parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third par...

CVE-2006-6464

Summary: CVE-2006-6464 relates to Midicart’s viewcart where the Qty field accepts negative numbers, allowing manipulation of the cart total to be smaller. The PT-2006-7073 entry confirms the vulnerability in Midicart (no affected versions specified) and states there is no information about a fix ...

CVE-2006-6463

The CVE-2006-6463 entry concerns Midicart’s admin/add.php, where an unrestricted file upload vulnerability exists. According to PT-2006-7072, remote authenticated users can upload arbitrary files (potentially including .php) to the images/ directory under the web root via the admin/add.php endpoi...

CVE-2006-6473

CVE-2006-6473 involves Xerox WorkCentre and WorkCentre Pro products. The connected documents indicate multiple unspecified vulnerabilities in these devices prior to 12.050.03.000, 13.x prior to 13.050.03.000, and 14.x prior to 14.050.03.000, with unknown impact and attack vectors. The issues are ...

CVE-2006-6466

CVE-2006-6466 affects WikyBlog 1.3.2 and earlier, due to cross-site scripting in WBmap.php allowing remote injection of arbitrary script/HTML via the (1) key, (2) d, (3) l, or (4) v parameters. The l vector is disputed since it is validated by ctype_alpha before use. This entry’s exploitation sta...

CVE-2006-6469

CVE-2006-6469 affects Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000. The issue is that these devices do not block the PostgreSQL port 5432/tcp, which could permit unauthorized connections to a PostgreSQL daemon. The available do...

CVE-2006-6470

The CVE-2006-6470 issue affects Xerox WorkCentre and WorkCentre Pro SNMP Agent implementations. Specifically, older firmware before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 may return no error for a non-writable SNMP object. The initial descriptions indicate the imp...

CVE-2006-6462

CVE-2006-6462 concerns CM68 News (version/date: 12.02.06) with a PHP remote file inclusion in engine/oldnews.inc.php. The underlying issue permits an attacker to execute arbitrary PHP code by supplying a URL in the addpath parameter. Public references confirm the vulnerable component and vulnerab...

CVE-2006-6468

Xerox WorkCentre and WorkCentre Pro products (before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000) do not verify the Fully Qualified Domain Name (FQDN) during a "Validate Repository SSL Certificate" scan. The description notes the impact and attack vectors are unknown. ...

CVE-2006-6471

Xerox WorkCentre and WorkCentre Pro betroffen: Versionen vor 12.050.03.000, 13.x vor 13.050.03.000 und 14.x vor 14.050.03.000 verwenden schwache Berechtigungen für bestimmte Dateien, was unkontrollierten Zugriff auf diese Dateien ermöglicht. Die Schwachstelle ergibt sich aus den Dateiberechtigung...

CVE-2006-6459

Cross-site scripting XSS vulnerability in toplist.php in PhpBB Toplist 1.3.7 allows remote attackers to inject arbitrary HTML or web script via the 1 Name and 2 Information fields when adding a new site toplistnew action...

CVE-2006-6460

Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php, which leaks the path in an error message. NOTE: this issue might be resultant from CVE-2006-2509...

CVE-2006-6459

CVE-2006-6459 describes a cross-site scripting (XSS) vulnerability in PhpBB Toplist 1.3.7. The flaw resides in toplist.php, allowing remote attackers to inject arbitrary HTML or web script via the (1) Name and (2) Information fields when adding a new site (action: toplistnew). The CVSS metrics in...

CVE-2006-6457

The CVE-2006-6457 issue affects tiki-wiki_rss.php in Tikiwiki 1.9.5 and 1.9.2 (and possibly other versions). The underlying flaw allows remote attackers to exfiltrate sensitive information by supplying an invalid (large or negative) ver parameter, causing the MySQL username and password to be lea...

CVE-2006-6460

YourFreeWorld.com Short Url & Url Tracker Script is affected by CVE-2006-6460: an invalid id parameter to login.php leaks the internal path via an error message, exposing sensitive information. The entry notes a possible relation to CVE-2006-2509. Connected sources confirm the affected product an...

CVE-2006-6461

CVE-2006-6461 affects tr1.php in Yourfreeworld Stylish Text Ads Script. The vulnerability allows remote attackers to obtain the installation path via an invalid id parameter, disclosed in an error message. The entry notes this issue may be related to CVE-2006-2508; the provided documents do not i...

CVE-2006-6460

Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php, which leaks the path in an error message. NOTE: this issue might be resultant from CVE-2006-2509...

CVE-2006-6456

CVE-2006-6456 is a remote code execution flaw in Microsoft Word 2000, Word 2002, Word 2003 and Word Viewer 2003 caused by malformed data structures in Word files. Attackers could exploit via specially crafted Word files (e.g., attachments or web-hosted content) to execute arbitrary code with the ...

CVE-2006-6458

The CVE-2006-6458 entry affects the Trend Micro scan engine before 8.320 on Windows and before 8.150 on HP-UX/AIX, used in Trend Micro PC Cillin Internet Security 2006, Office Scan 7.3, and Server Protect 5.58. Root cause: processing a malformed RAR archive where the Archive Header head_size and ...

Important gnupg security update

1.2.6-8 - incorporate patch from Werner to fix use of stack variable after it goes out of scope CVE-2006-6235, 218480 1.2.6-7 - add patch for overflow in openfile.c from Werner's mail CVE-2006-6169...